EUVD-2026-23203Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Livemesh Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 9.0. This is due to missing authorization checks on the AJAX handler lae_admin_ajax() and insufficient output escaping on multiple checkbox settings fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever an administrator accesses the plugin settings page granted they can obtain a valid nonce, which can be leaked via the plugin's improper access control on settings pages.
AnalysisAI
Livemesh Addons for Elementor plugin versions up to 9.0 allow authenticated attackers with Subscriber-level access to inject arbitrary JavaScript via the plugin settings page through missing authorization checks on the AJAX handler lae_admin_ajax() and insufficient output escaping on checkbox fields. The injected scripts execute whenever an administrator accesses the settings page if the attacker obtains a valid nonce, which can be leaked due to improper access control on settings pages. This combination of authorization bypass and stored XSS affects all WordPress installations running the vulnerable plugin.
Technical ContextAI
The vulnerability exists in the Livemesh Addons for Elementor WordPress plugin's administrative AJAX handler. The lae_admin_ajax() function in admin/admin-ajax.php fails to verify user capabilities before processing settings modifications, allowing any authenticated user (Subscriber level and above) to submit arbitrary data to the plugin settings. Additionally, checkbox settings fields in admin/views/settings.php lack proper output escaping when rendering stored values, enabling stored XSS attacks. The root cause is twofold: CWE-79 (Improper Neutralization of Input During Web Page Generation) combined with missing authorization checks. The nonce leak vulnerability stems from improper access control on the settings page itself, exposing the security token needed to carry out the attack. This is a typical WordPress plugin vulnerability pattern where AJAX endpoints check for nonce validity but fail to verify appropriate user capabilities or roles for the specific action being performed.
RemediationAI
The primary remediation is to update the Livemesh Addons for Elementor plugin to a patched version beyond 9.0 as soon as the vendor releases it; however, no specific patched version number is provided in the available data, so administrators should monitor the plugin's WordPress repository page and Wordfence vulnerability database at https://www.wordfence.com/threat-intel/vulnerabilities/id/24b9bf5a-19ac-4e99-b32d-1ab681356a1b for patch availability. Until a patch is released, the following compensating controls mitigate exploitation: first, disable user registration on the WordPress site to eliminate Subscriber-level access creation, though this removes a core WordPress feature and should only be applied if user-generated content is not required; second, restrict access to wp-admin entirely for non-administrator roles using a web application firewall or .htaccess rules, which prevents low-privileged users from accessing the settings page where nonce leaks occur; third, implement strict Content Security Policy (CSP) headers to block inline script execution, reducing XSS impact even if injection succeeds-however, many WordPress plugins conflict with CSP directives, so thorough testing is required before deployment. Wordfence recommends checking their advisory at the provided link for additional guidance and timeline information on patch availability.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today